--- title: "Compare state privacy laws: controller duties" canonical: "https://dposchool.com/state-privacy-laws/topic/controller-duties" source: - "https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&part=4.&title=1.81.5." - "https://law.lis.virginia.gov/vacodefull/title59.1/chapter53/" - "https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf" - "https://www.cga.ct.gov/current/pub/chap_743jj.htm" - "https://le.utah.gov/xcode/Title13/Chapter61/13-61.html" - "https://www.oregonlegislature.gov/bills_laws/ors/ors646A.html" - "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm" - "https://archive.legmt.gov/bills/mca/title_0300/chapter_0140/part_0280/sections_index.html" - "https://delcode.delaware.gov/title6/c012d/index.html" - "https://www.legis.iowa.gov/docs/code/715D.pdf" - "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101" - "https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm" - "https://pub.njleg.state.nj.us/Bills/2022/PL23/266_.HTM" - "https://publications.tnsosfiles.com/acts/113/pub/pc0408.pdf" - "https://www.revisor.mn.gov/statutes/cite/325M.10" - "https://mgaleg.maryland.gov/mgawebsite/Laws/StatuteText?article=gcl§ion=14-4701&enactments=false" - "https://iga.in.gov/ic/2026/Title_24.pdf" - "https://apps.legislature.ky.gov/law/statutes/chapter.aspx?id=39092" - "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm" - "https://legis.la.gov/legis/ViewDocument.aspx?d=1480202" - "https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/SB/SB546%20ENR.pdf" - "https://alison.legislature.state.al.us/files/pdf/SearchableInstruments/2026RS/HB351-enr.pdf" - "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf" - "http://www.leg.state.fl.us/statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/0501PartVContentsIndex.html" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- # Compare state privacy laws: controller duties Notices, opt-out signals, data protection assessments and minimization. Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) Each entry gives the statute section it comes from. "None" means the law has no such test, period or right. Reference material, not legal advice. | State | Universal opt-out signal | Data protection assessments | Data minimization standard | | --- | --- | --- | --- | | [California](https://dposchool.com/state-privacy-laws/state/california/controller-duties) | required (regulations in force; browser signal duty from 2027-01-01) (Cal. Code Regs. tit. 11, § 7025; Cal. Civ. Code § 1798.136) | required (risk assessments from 2026-01-01; CPPA submissions from 2028-04-01) (Cal. Code Regs. tit. 11, §§ 7150, 7157) | reasonably necessary and proportionate (Cal. Civ. Code § 1798.100(c)) | | [Virginia](https://dposchool.com/state-privacy-laws/state/virginia/controller-duties) | not required (§ 59.1-578) | required (§ 59.1-580) | adequate, relevant and reasonably necessary (§ 59.1-578(A)(1)) | | [Colorado](https://dposchool.com/state-privacy-laws/state/colorado/controller-duties) | required from 2024-07-01 (C.R.S. § 6-1-1306(1)(a)(IV)(B)) | required (C.R.S. § 6-1-1309) | adequate, relevant and limited to what is reasonably necessary (C.R.S. § 6-1-1308(3)) | | [Connecticut](https://dposchool.com/state-privacy-laws/state/connecticut/controller-duties) | required from 2025-01-01 (Conn. Gen. Stat. § 42-520(c)(1)(A)(ii)) | required (Conn. Gen. Stat. § 42-522(b)) | reasonably necessary and proportionate (from 2026-07-01) (Conn. Gen. Stat. § 42-520(a)(1)(A)) | | [Utah](https://dposchool.com/state-privacy-laws/state/utah/controller-duties) | not required (§§ 13-61-201 to 13-61-302) | not required (§§ 13-61-301 to 13-61-305) | no express duty in the text (§ 13-61-302) | | [Oregon](https://dposchool.com/state-privacy-laws/state/oregon/controller-duties) | required from 2026-01-01 (ORS 646A.578(5)(c)) | required (ORS 646A.586) | reasonably necessary (ORS 646A.578(1)(b)) | | [Texas](https://dposchool.com/state-privacy-laws/state/texas/controller-duties) | required from 2025-01-01 (§ 541.055(e)) | required (§ 541.105) | reasonably necessary (§ 541.101(a)(1)) | | [Montana](https://dposchool.com/state-privacy-laws/state/montana/controller-duties) | required from 2025-01-01 (§ 30-14-2809(3)(b)) | required (§ 30-14-2814; § 30-14-2819) | reasonably necessary (§ 30-14-2812(1)(a)) | | [Delaware](https://dposchool.com/state-privacy-laws/state/delaware/controller-duties) | required from 2026-01-01 (§ 12D-106(e)(1)a.2) | required (controllers with 100,000+ consumers; 50,000+ from 2027-01-01) (§ 12D-108(a)) | reasonably necessary (reasonably necessary and proportional from 2027-01-01) (§ 12D-106(a)(1)) | | [Iowa](https://dposchool.com/state-privacy-laws/state/iowa/controller-duties) | not required (§ 715D.4) | not required (§ 715D.4) | no duty (§ 715D.4) | | [Nebraska](https://dposchool.com/state-privacy-laws/state/nebraska/controller-duties) | authorized agent technology (such as browser or device setting) to be honoured from 2025-01-01, subject to exceptions (§ 87-1111(5)) | required (§ 87-1116) | reasonably necessary (§ 87-1112(1)(a)) | | [New Hampshire](https://dposchool.com/state-privacy-laws/state/new-hampshire/controller-duties) | required from 2025-01-01 (RSA 507-H:6, V(a)(1)(B)) | required (RSA 507-H:8, I) | reasonably necessary (RSA 507-H:6, I(a)) | | [New Jersey](https://dposchool.com/state-privacy-laws/state/new-jersey/controller-duties) | required from 2025-07-15 (C.56:8-166.11(b)(1)) | required (C.56:8-166.12(a)(10)) | reasonably necessary (C.56:8-166.12(a)(1)) | | [Tennessee](https://dposchool.com/state-privacy-laws/state/tennessee/controller-duties) | not required (Tenn. Code Ann. § 47-18-3305) | required (Tenn. Code Ann. § 47-18-3307(a)) | reasonably necessary (Tenn. Code Ann. § 47-18-3305(a)(1)) | | [Minnesota](https://dposchool.com/state-privacy-laws/state/minnesota/controller-duties) | required from 2025-07-31 (§ 325M.14, subd. 3) | required (§ 325M.18(b)) | reasonably necessary (plus retention limit and data inventory) (§ 325M.16, subd. 2(a), (c) and (g)) | | [Maryland](https://dposchool.com/state-privacy-laws/state/maryland/controller-duties) | opt-out preference signal listed as a method from 2025-10-01; authorized agent browser or device settings must be honoured (§ 14-4707(f)(3)(ii); § 14-4706) | required (including each algorithm used) (§ 14-4710(b)) | reasonably necessary and proportionate to a requested product or service; strictly necessary for sensitive data (§ 14-4707(a)(1); § 14-4707(b)(1)(i)) | | [Indiana](https://dposchool.com/state-privacy-laws/state/indiana/controller-duties) | not required (IC 24-15-4) | required (IC 24-15-6-1(b)) | reasonably necessary (IC 24-15-4-1(1)) | | [Kentucky](https://dposchool.com/state-privacy-laws/state/kentucky/controller-duties) | not required (KRS 367.3611 to 367.3629) | required (for activities created or generated on or after 2026-06-01) (KRS 367.3621(1) and (8)) | reasonably necessary (KRS 367.3617(1)(a)) | | [Rhode Island](https://dposchool.com/state-privacy-laws/state/rhode-island/controller-duties) | not required (§ 6-48.1-5; § 6-48.1-6) | required (§ 6-48.1-7(e)) | no general duty (reasonably necessary and proportionate only for processing under exemptions) (§ 6-48.1-7(s)) | | [Louisiana](https://dposchool.com/state-privacy-laws/state/louisiana/controller-duties) | conditional, from 2027-01-01 (authorized agent technology, with exceptions) (La. R.S. 51:1780.3(E)(5), (6)) | required (La. R.S. 51:1780.4(E)) | adequate, relevant and reasonably necessary (La. R.S. 51:1780.4(A)(1)(a)) | | [Oklahoma](https://dposchool.com/state-privacy-laws/state/oklahoma/controller-duties) | not required (SB 546 §§ 2 to 8 (75A O.S. §§ 301 to 307)) | required (SB 546 § 10 (75A O.S. § 309)) | adequate, relevant and reasonably necessary (SB 546 § 7(A)(1) (75A O.S. § 306)) | | [Alabama](https://dposchool.com/state-privacy-laws/state/alabama/controller-duties) | not expressly required (conflict rule only) (Act 2026-552, § 6(c) (Ala. Code § 8-44-6)) | not required (Act 2026-552, §§ 7 to 10 (Ala. Code §§ 8-44-7 to 8-44-10)) | adequate, relevant and reasonably necessary (Act 2026-552, § 7(a)(1) (Ala. Code § 8-44-7)) | | [Vermont](https://dposchool.com/state-privacy-laws/state/vermont/controller-duties) | required from 2028-01-01 (Act 145, Sec. 1, 9 V.S.A. § 2415e(d)(2)(C)) | required (Act 145, Sec. 1, 9 V.S.A. § 2415g) | reasonably necessary and proportionate (Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(1)) | | **Narrower laws** | | | | | [Florida](https://dposchool.com/state-privacy-laws/state/florida/controller-duties) | not required (Fla. Stat. § 501.705) | required (Fla. Stat. § 501.713) | adequate, relevant and reasonably necessary (Fla. Stat. § 501.71(1)(a)) | ## Other comparisons - [Applicability](https://dposchool.com/state-privacy-laws/topic/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/topic/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/topic/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/topic/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/topic/enforcement) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Compare: Controller duties Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents